Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

mkrishnan

Moderator emeritus
Original poster
Jan 9, 2004
29,776
15
Grand Rapids, MI, USA
Hi,

I'm getting recurrent threat warnings from AVG about OSX/InstallCore.O, which are from reputable software package contents (e.g. Skype in the example). I'm having a hard time understanding if this is legitimate, and not finding clarity from searches I've done. Is this because Skype used InstallCore to install? I understood InstsallCore is a non-viral adware/malware, so otherwise I don't know how it got into those package contents. Any help would be lovely!
 

Attachments

  • Screen Shot 2016-03-03 at 11.09.08 AM.png
    Screen Shot 2016-03-03 at 11.09.08 AM.png
    1.4 MB · Views: 373

chrfr

macrumors G5
Jul 11, 2009
13,729
7,306
Hi,

I'm getting recurrent threat warnings from AVG about OSX/InstallCore.O, which are from reputable software package contents (e.g. Skype in the example). I'm having a hard time understanding if this is legitimate, and not finding clarity from searches I've done. Is this because Skype used InstallCore to install? I understood InstsallCore is a non-viral adware/malware, so otherwise I don't know how it got into those package contents. Any help would be lovely!
Did you install Skype after downloading an installer from macupdate.com? Their installers often include adware now, which may show up as Installcore.
 

mkrishnan

Moderator emeritus
Original poster
Jan 9, 2004
29,776
15
Grand Rapids, MI, USA
@old-wiz Yes, I've noticed that. Thank you both for the suggestion. I don't think it's that. I'm doing a full scan, which is still running, but other apps that have been flagged for the same issue include Xcode of all things. I think the issue is due to this setting - "Use enhanced scanning to identify even more PUAs". I don't remember selecting it, but their help says it is off by default. Its flagged >200 issues on my MBP's drive so far, and given that it didn't flag any a few weeks ago... I'll update if that's what it is (especially because I searched and didn't find anything about this, and I don't know how / why that option got selected).
 

Attachments

  • Screen Shot 2016-03-03 at 1.36.03 PM.png
    Screen Shot 2016-03-03 at 1.36.03 PM.png
    216.4 KB · Views: 261
  • Like
Reactions: old-wiz

\-V-/

Suspended
May 3, 2012
3,153
2,688
MacUpdate will download spyware to your computer if you are not logged into your account. This is a widely known issue that's pissing many people off.

Also, AVG is crap.
 
  • Like
Reactions: old-wiz

mkrishnan

Moderator emeritus
Original poster
Jan 9, 2004
29,776
15
Grand Rapids, MI, USA
The issue is with the PUA settings in AVG (and @\-V-/ your point is taken -- I turned these settings off for now, but perhaps I need to change AV software). Many of the apps identified came from Apple's App Store. None of them came from MacUpdate, which I don't use (i did, back in the day, 10 years ago, but not now).
 

bobob@mac

macrumors newbie
Mar 16, 2016
1
0
Hi

I am having the exact same problem as this - both Skype and Xcode have been flagged as containing this threat. Did you find a resolution ??

Best regards

Bob
 

simon lefisch

macrumors 65816
Sep 29, 2014
1,006
253
ClamXav is pretty good. Unfortunate you have to pay now, but ran well when I was using it back when it was free. Download from the site, not from the App Store.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.